Cloud SQL SQL Server: cross db ownership chaining = off

Check ID: cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag
Provider: GCP
Service: cloudsql
Severity: HIGH
Categories: identity-access, trust-boundaries
Resource type: sqladmin.googleapis.com/Instance

What this check verifies

Cloud SQL SQL Server instances are evaluated for the cross db ownership chaining server flag. The finding identifies SQL Server instances where this flag isn’t set to off, meaning cross-database ownership chaining is permitted.

Risk

Allowing cross-database ownership chaining erodes database boundaries, impacting confidentiality and integrity. Users with privileges in one database can traverse ownership chains to access or modify objects in others, enabling privilege escalation, lateral movement, and unauthorized data exposure.

Recommendation

Keep cross db ownership chaining set to off to maintain database isolation. Enforce least privilege with explicit per-database permissions and separation of duties. Prefer controlled execution patterns (e.g., signed modules) over implicit trusts, and periodically review flags and access. This flag is deprecated-do not enable it.

Remediation

CLI
Terraform
Dashboard steps

gcloud sql instances patch <example_resource_name> --database-flags '"cross db ownership chaining"=off'

resource "google_sql_database_instance" "<example_resource_name>" {
  name             = "<example_resource_name>"
  region           = "<REGION>"
  database_version = "SQLSERVER_2019_STANDARD"

  settings {
    tier = "<TIER>"

    # Critical: ensures the flag is OFF to pass the check
    database_flags {
      name  = "cross db ownership chaining"  # disables cross-database ownership chaining
      value = "off"
    }
  }
}

References

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

Cloud SQL SQL Server: contained db authentication = off Cloud SQL SQL Server: external scripts enabled = off

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires